SunPump Meme Token Toolkit
Pass
Audited by Gen Agent Trust Hub on Jun 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing shell commands via the
@bankofai/sun-clitool. This includes both read-only operations (querying token info) and write operations (executing trades). The instructions emphasize the use of--jsonfor structured output and--yesfor skipping confirmation in automated flows, though security rules in the documentation mandate a user-facing preview before execution. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8) because it ingests and processes untrusted data from the SunPump API.
- Ingestion points: Data enters the agent's context through
sun sunpump token get,sun sunpump portfolio, andsun sunpump tx usercommand outputs (located in SKILL.md sections 3, 4, 5, 6, and 7). - Boundary markers: The skill uses the
--jsonflag to ensure data is returned in a structured format, which helps the agent distinguish between data and instructions, though no explicit 'ignore embedded instructions' markers are defined for the JSON content. - Capability inventory: The agent has the capability to perform financial transactions (
sun swap,sun sunpump buy/sell) and network requests (via the CLI tool). - Sanitization: There is no explicit sanitization or filtering of token metadata (descriptions, symbols) or holder names mentioned before the agent processes them.
Audit Metadata